Skip to content

[cross-compile] Make pkg/apparmor cross compilable #5084

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

[cross-compile] Make pkg/apparmor cross compilable #5084

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7fc968b
Fix Dockerfile syntax and copyright date
rucoder Jul 14, 2025
5d06ac9
[cross-compile] pkg/apparmor
rucoder Jul 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 57 additions & 9 deletions pkg/apparmor/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,28 +1,76 @@
# syntax=docker/dockerfile-upstream:1.5.0-rc2-labs

# Copyright (c) 2023 Zededa, Inc.
# Copyright (c) 2023-2025 Zededa, Inc.
# SPDX-License-Identifier: Apache-2.0

FROM lfedge/eve-alpine:0f2e0da38e30753c68410727a6cc269e57ff74f2 as build
ENV BUILD_PKGS linux-headers musl-dev musl-utils musl-libintl git gcc g++ \
autoconf automake libtool make flex bison bash sed gettext
FROM --platform=${BUILDPLATFORM} lfedge/eve-alpine:0f2e0da38e30753c68410727a6cc269e57ff74f2 as builder-native-base
Copy link
Contributor

@rene rene Jul 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FROM ... AS ... (as uppercase as well)...

ENV BUILD_PKGS="linux-headers musl-dev musl-utils musl-libintl git gcc g++ \
autoconf automake libtool make flex bison bash sed gettext"
ENV PKGS alpine-baselayout
RUN eve-alpine-deploy.sh

FROM --platform=${BUILDPLATFORM} lfedge/eve-cross-compilers:fb809cfb1909752acb563e0b77cd3799534bce64 AS cross-compilers

FROM builder-native-base as builder-cross-base
COPY --from=cross-compilers /packages /packages
Copy link
Contributor

@deitch deitch Jul 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you not just move FROM .... AS cross-compilers to before line 6 (previous FROM), and then COPY these into builder-native-base? Or is this a different platform?

This needs comments to make it clear what each one is doing, as well as how the whole flow works. I mostly get what you are doing, but miss some of the steps.


FROM builder-cross-base as builder-target-arm64
ARG COMPILER_TARGET_ARCH=aarch64
Copy link
Contributor

@rene rene Jul 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the documentation (https://github.com/lf-edge/eve/blob/master/docs/BUILD.md#cross-compilation-support), we recommend to call this variable EVE_TARGET_ARCH, as used in other packages... not critical, but would be good to keep the pattern...


FROM builder-cross-base as builder-target-amd64
ARG COMPILER_TARGET_ARCH=x86_64

FROM --platform=${TARGETPLATFORM} lfedge/eve-alpine:0f2e0da38e30753c68410727a6cc269e57ff74f2 as target-sysroot
# Install the target sysroot
ENV BUILD_PKGS="musl-dev libgcc musl-libintl libintl linux-headers"
RUN eve-alpine-deploy.sh

#hadolint ignore=DL3006
FROM builder-target-${TARGETARCH} as builder-target
# install cross compiler
#hadolint ignore=DL3006,DL3018
RUN apk add --no-cache --allow-untrusted -X /packages "build-base-${COMPILER_TARGET_ARCH}"

FROM builder-target as builder-amd64-arm64
ENV CONFIGURE_TARGETS="--build=aarch64-alpine-linux-musl --host=x86_64-alpine-linux-musl"
# copy libraries from target-sysroot
COPY --from=target-sysroot /usr/lib/ /usr/x86_64-alpine-linux-musl/lib/
Copy link
Contributor

@rene rene Jul 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

instead of copying the whole /usr/lib and /usr/include you can use an approach like this to create the target libraries:
https://github.com/lf-edge/eve/blob/master/pkg/pillar/Dockerfile#L40

so you install only the libraries you need and they will be available at /out, you can even use a single code block to automate the process for the target architecture: https://github.com/lf-edge/eve/blob/master/pkg/pillar/Dockerfile#L53

Copy link
Contributor Author

@rucoder rucoder Jul 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rene sure, I actually did not mean to merge it to be honest, but I can fix it 👍

COPY --from=target-sysroot /usr/include/ /usr/x86_64-alpine-linux-musl/include/
ENV CXX=x86_64-alpine-linux-musl-g++


FROM builder-target as builder-arm64-amd64
ENV CONFIGURE_TARGETS="--host=aarch64-alpine-linux-musl --build=x86_64-alpine-linux-musl"
# copy libraries from target-sysroot
COPY --from=target-sysroot /usr/lib/ /usr/aarch64-alpine-linux-musl/lib/
COPY --from=target-sysroot /usr/include/ /usr/aarch64-alpine-linux-musl/include/
ENV CXX=aarch64-alpine-linux-musl-g++


FROM builder-native-base as builder-amd64-amd64
ENV CONFIGURE_TARGETS=

FROM builder-native-base as builder-arm64-arm64
ENV CONFIGURE_TARGETS=

#hadolint ignore=DL3006
FROM builder-${TARGETARCH}-${BUILDARCH} as builder

ADD https://gitlab.com/apparmor/apparmor.git#v3.1.4 /apparmor
WORKDIR /apparmor/libraries/libapparmor
# hadolint ignore=SC2086
RUN ./autogen.sh && \
./configure && \
make
(./configure ${CONFIGURE_TARGETS} || cat ./config.log) && \
make -j"$(nproc)"

WORKDIR /apparmor/parser
RUN ../common/list_af_names.sh > base_af_names.h && \
make
make -j"$(nproc)"
Copy link
Contributor

@christoph-zededa christoph-zededa Jul 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a wise man once said: #4775 (comment) ;-)

Copy link
Contributor Author

@rucoder rucoder Jul 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@christoph-zededa yeah.. I was lazy to look for the proper variable name


#Pull a selected set of artifacts into the final stage.
FROM scratch
COPY --from=build /out/ /
COPY --from=build /apparmor/parser/apparmor_parser /usr/bin/
COPY --from=builder /out/ /
COPY --from=builder /apparmor/parser/apparmor_parser /usr/bin/
COPY /etc/ /etc
COPY /profiles/* /etc/apparmor.d
COPY aa-init.sh /
Expand Down